GHSA-c6gr-qvv4-5v3f: DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml

DOMPurify drops attributeName attributes whose value contains href, so an allowed <animate> or <set> can’t rewrite a link’s href after sanitizing. The check compares the attribute name after transformCaseFunc, and that function doesn’t lowercase in XHTML mode. In XHTML the attribute is spelled attributeName, so the comparison with "attributename" never matches and the guard does nothing.

An app that uses PARSER_MEDIA_TYPE: 'application/xhtml+xml' and allows animate and attributeName will keep <animate attributeName="href" values="x;javascript:alert(1)">. Clicking the parent link then runs the script.

This needs a non-default config, so going by SECURITY.md, this is a hardening bug rather than a bypass of the default config.